# Filebeat 8.15.0 output to logstash instead of ES, and Kibana dashboard does not display properly

**URL:** <https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 29, 2024, 8:47am UTC](https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746 "2024-08-29T08:47:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ygqygq2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ygqygq2/32/137140_2.png) [@ygqygq2](https://discuss.elastic.co/u/ygqygq2)\
**Post date:** [August 29, 2024, 8:47am UTC](https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746/1 "2024-08-29T08:47:11Z")

</div>

Filebeat 8.15.0 output to logstash instead of ES, how to set logstash? I tried, but couldn't parse it like a connection to es.

---

<div class="post-metadata">

**Author:** ![ygqygq2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ygqygq2/32/137140_2.png) [@ygqygq2](https://discuss.elastic.co/u/ygqygq2)\
**Post date:** [August 29, 2024, 8:48am UTC](https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746/2 "2024-08-29T08:48:05Z")

</div>

From #Logstash to #Beats

---

<div class="post-metadata">

**Author:** ![ygqygq2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ygqygq2/32/137140_2.png) [@ygqygq2](https://discuss.elastic.co/u/ygqygq2)\
**Post date:** [August 29, 2024, 8:48am UTC](https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746/3 "2024-08-29T08:48:05Z")

</div>

Added #filebeat

---

<div class="post-metadata">

**Author:** ![ygqygq2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ygqygq2/32/137140_2.png) [@ygqygq2](https://discuss.elastic.co/u/ygqygq2)\
**Post date:** [August 29, 2024, 9:29am UTC](https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746/4 "2024-08-29T09:29:32Z")

</div>

The pipeline run failed.

```auto
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 6257,
      "relation": "eq"
    },
    "max_score": null,
    "hits": [
      {
        "_index": ".ds-filebeat-8.15.0-2024.08.27-000001",
        "_id": "Fw93nZEB6-W6QuqIYb05",
        "_score": null,
        "_source": {
          "agent": {
            "name": "elk-node1",
            "id": "43fb58ac-a734-49bc-8df0-e268d0d173e4",
            "ephemeral_id": "ce52a25b-66be-492f-9bb2-b7ceafb162ef",
            "type": "filebeat",
            "version": "8.15.0"
          },
          "log": {
            "file": {
              "path": "/data/docker/elk/nginx/logs/access.log"
            },
            "offset": 2060972
          },
          "message": "10.178.32.127 - - [29/Aug/2024:09:28:38 +0000] \"POST /api/ui_counters/_report HTTP/1.1\" 200 15 \"http://10.199.205.165/app/dev_tools\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36\" \"-\"",
          "fileset": {
            "name": "access"
          },
          "error": {
            "message": "field [event.original] already exists"
          },
          "tags": [
            "beats_input_codec_plain_applied"
          ],
          "input": {
            "type": "log"
          },
          "@timestamp": "2024-08-29T09:28:38.808Z",
          "ecs": {
            "version": "1.12.0"
          },
          "service": {
            "type": "nginx"
          },
          "host": {
            "name": "elk-node1"
          },
          "@version": "1",
          "event": {
            "ingested": "2024-08-29T09:28:52.281427801Z",
            "original": "10.178.32.127 - - [29/Aug/2024:09:28:38 +0000] \"POST /api/ui_counters/_report HTTP/1.1\" 200 15 \"http://10.199.205.165/app/dev_tools\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36\" \"-\"",
            "timezone": "+08:00",
            "module": "nginx",
            "dataset": "nginx.access"
          }
        },
        "sort": [
          1724923718808
        ]
      }
    ]
  }
}

```

---

<div class="post-metadata">

**Author:** ![ygqygq2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ygqygq2/32/137140_2.png) [@ygqygq2](https://discuss.elastic.co/u/ygqygq2)\
**Post date:** [August 29, 2024, 10:16am UTC](https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746/5 "2024-08-29T10:16:54Z")

</div>

> [@Aws ingest pipeline error in processor rename "message" to "event.original"](https://discuss.elastic.co/t/aws-ingest-pipeline-error-in-processor-rename-message-to-event-original/341472/8):
>
> But it is an issue for the ingest pipeline. Filebeat modules uses ingest pipelines in Elasticsearch, so it is expected that the original message collected will be sent directly to Elasticsearch. When you add Logstash between filebeat and elasticsearch the original message can change and this can break the ingest pipeline in multiple points. For example, in the [cloudtrail ingest pipeline](https://github.com/elastic/beats/blob/main/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml), you have this processor in the beginning: - rename: field: "message" target\_field: "event.…

remove `'[event][original]'` can resolve.

```auto
filter {
  if [@metadata][pipeline] {
    ruby {
      code => "event.remove('[event][original]')"
    }
  }
}

```